Contact us

Legal

Data Protection Policy

Version: 7.0
Published: November 2026
Review date: June 2027

At Getech, we treat the privacy of our staff, partners and customers with the utmost seriousness. We have established clear protocols for handling data breaches and robust mechanisms for individuals to exercise their rights over their own information.

Whether we are processing orders, managing employee records, or conducting hardware repairs, we adhere to core data protection principles: fairness, transparency, accuracy and storage limitation.

This policy details how we gather, retain and secure data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Overview and Purpose

This policy should be read alongside the relevant website’s privacy notice, which explains how and why Getech Limited processes personal data. Getech gathers and retains personal data about employees, customers, and third parties to provide services and manage professional relationships. This corporate Data Protection Policy sets out how Getech seeks to comply with the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the UK GDPR. ICO registration number: Z7161654.

2. Data Protection Principles

Personal data must always be:

  • Lawful, fair and transparent: Processed clearly and with a legal basis.
  • Purpose-specific: Collected only for explicit, legitimate purposes.
  • Minimal: Adequate and limited only to what is necessary.
  • Accurate: Kept up to date; inaccurate data must be erased or rectified.
  • Limited storage: Kept only for as long as necessary.
  • Secure: Processed using appropriate security measures.


Getech must also be able to demonstrate compliance with these principles through appropriate accountability measures.

3. How We Protect Personal Data

Every person working for Getech is responsible for ensuring data is handled appropriately:

  • Access: Only access personal data if it is required for your specific role and you are authorised to do so.
  • Passwords: Use unique, strong passwords, manage them in accordance with Getech’s approved password and access-control requirements, and never share them.
  • Security: Lock your computer screen whenever you are away from your desk. Lock physical drawers and filing cabinets.
  • Transfer: Only transfer personal data to authorised recipients using approved secure systems and methods.
  • Prohibitions: Do not save personal data to personal devices or take data off Getech premises or systems without explicit authorisation.
  • Children’s/pupil data: Names or details of under-18s, pupils or students must only be collected where necessary, treated as confidential, shared only with authorised staff, and deleted when no longer needed — normally within 30 days after the relevant purpose has been completed, unless a documented legal, contractual, warranty, dispute, audit, safeguarding or other lawful operational requirement justifies longer retention.

4. Subject Access Requests (SARs)

Individuals, including employees, workers, customers, end users, suppliers, school contacts, pupils/students where relevant, and other third parties, have the right to request a copy of the information Getech holds about them. A SAR can be made verbally or in writing.

  • Action: SARs must be forwarded to the Data Protection Officer (DPO@getech.co.uk) immediately.
  • Timeline: Getech must typically respond within one month.

5. Reporting Data Breaches

  • Internal Reporting: Potential data breaches or risks must be reported to the Data Protection Officer or a member of the Senior Leadership Team (SLT) immediately.
  • External Reporting: If a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Getech must notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it.

6. Your Rights as a Data Subject

You may have the right to access your personal data, correct inaccuracies, request erasure, restrict processing, object to certain processing, and, in some circumstances, request data portability. SARs and all other data subject rights requests must be directed to the Data Protection Officer.

7. Examples of when Getech might process personal data

Deliberate or negligent breaches of this policy are serious matters that may result in disciplinary action under Getech’s Disciplinary Policy, potentially leading to dismissal.